Deployment Architecture

How to prevent duplicate events from occurring when connecting a non-clustered search head with an indexer cluster?

realsplunk
Motivator

Hello guys,

I've setup a separated search head using distributed search with clustered indexers (in order to have a different portal with different authentication)

However if I select more than one indexer then I get duplicate events.

Any idea to search all indexers without duplicate events?

Thanks.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi realsplunk,
are you sure that you are sending events to your two indexers in auto load balancing and not in duplication?
verify it in outputs.conf file of your Universal Forwarder:
you are using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997, yyy.yyy.yyy.yyy:9997

you aren't using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997
[tcpout:stanza2]
server =  yyy.yyy.yyy.yyy:9997

Bye.
Giuseppe

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi @realsplunk,

If you want to use standalone searchhead to search data from all clustered indexers without duplicate data then point your standalone search head to cluster master of Indexer cluster, do not add any indexer in Distributed search -> Search Peer.

When you will point standalone search head to cluster master of all indexer, Distibuted search -> Search Peer will be automatically updated with all indexers. Now when you search from this stand alone search head it will not display duplicate events from clustered indexers.

Thanks,
Harshil

realsplunk
Motivator

Thanks Harshil, do you mean I can add that cluster master (it's also our deployment server and is not indexing data) in distributed search or I must add the new search head in the cluster (which I don't want as i want separate authentication, customization...) ?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Not Cluster master in Distributed Search but follow this URL http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Enablethesearchhead to point non-clustred search head to Cluster Master of Indexer cluster.

I am also running Cluster Search Head & Non clustered search head to same indexer cluster for different requirement.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi realsplunk,
are you sure that you are sending events to your two indexers in auto load balancing and not in duplication?
verify it in outputs.conf file of your Universal Forwarder:
you are using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997, yyy.yyy.yyy.yyy:9997

you aren't using auto load balancing if you have:

[tcpout:stanza1]
server = xxx.xxx.xxx.xxx:9997
[tcpout:stanza2]
server =  yyy.yyy.yyy.yyy:9997

Bye.
Giuseppe

View solution in original post

realsplunk
Motivator

Hi cusello, auto load balancing is OK, there isn't duplicate events if I search on one of the clustered search heads, only on that new separated search head with distributed search.

[tcpout]
defaultGroup = ssl_9997
useACK = true
maxQueueSize = 100MB
[tcpout:ssl_9997]
server = xxx01:9997, yyy01:9997
[tcpout-server://xxx01:9997]
sslCertPath=$SPLUNK_HOME/etc/auth/server.pem
sslPassword=password
sslRootCAPath=$SPLUNK_HOME/etc/apps/APP_OUTPUTS/local/cacert.pem
sslVerifyServerCert=false
[tcpout-server://yyy01:9997]
sslCertPath=$SPLUNK_HOME/etc/auth/server.pem
sslPassword=password
sslRootCAPath=$SPLUNK_HOME/etc/apps/APP_OUTPUTS/local/cacert.pem
sslVerifyServerCert=false

Thanks for your help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

realsplunk
Motivator

It works, thanks a lot!

I kept 'standalone' mode on that search head and only search head role.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!